Privacy & the media. Traditional and emerging protections in an online world.

Transcription

1 Privacy & the media. Traditional and emerging protections in an online world. IP/IT MEDIA & TELECOM- Workshop - LONDON 2015 National Report of The Netherlands Irene Feenstra Kennedy Van der Laan Haarlemmerweg LH, Amsterdam The Netherlands irene.feenstra@kvdl.nl Marc Elshof Boekel De Nerée N.V. Gustav Mahlerplein MA, Amsterdam The Netherlands marc.elshof@boekel.com General Reporters: Jerome Debras, Woog & Associés, Paris, France jdebras@woogassocies.com Cristina Hernandez-Marti Perez, Hernandez Marti Abogados, Barcelona, Spain cristina@hernandez-marti.com 7 March 2015

2 1. Privacy rights Under Privacy right, we understand the right not to have information about a person to be disclosed to other persons without consent of the person the which the information refers to Are privacy rights statutory rights or are these case-law based? Privacy rights are statutory rights, set out in various laws and treaties. Article 8 of the Charter of Fundamental Rights of the European Union recognises the protection of personal data a fundamental right. Article 7 of the Charter of Fundamental Rights of the European Union grants the right of protection of their private and family life. Article 8 of the European Convention on Human Rights also recognises the right to respect for private and family life as a basic human right. Article 10 of the Dutch Constitution provides for the protection of private life and includes an obligation to protect personal data by law. This law is the Dutch Data Protection Act (Wet bescherming persoonsgegevens), which is based on the EU Data protection directive (95/46/EC). Other EU directives that relate to privacy and data protection that have been implemented in Dutch law include the E- Privacy Directive (2002/58 as amended by Directive 2009/136). Currently a draft for the EU Data Protection Regulation is being discussed. This Regulation, which will in general increase the protection of personal data, is expected to enter into force in In addition, there are various acts that prescribe how police and other law enforcement agencies may process personal data What type of information (including pictures, sounds, etc.) would be covered by the concept of privacy rights in the legal system of your country? A distinction should be made between personal data and privacy, whereby the latter encompasses the former but is also broader: it includes the right to an undisturbed private and family life, also if no personal data are being processed. Personal data is defined as any information relating to an identified or identifiable natural person (the data subject). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific

3 to his physical, physiological, mental, economic, cultural or social identity (article 2 (a) of the Data Protection Directive 95/46/EC, implemented in article 1 (a) of the Dutch Data Protection Act). It is a broad concept that includes obvious information such as name, address and phone number, but also includes DNA, IP address, fingerprints, license plates and certain types of cookies. Pictures, camera footage (including CCTV) as well as voice recordings would all come under the concept of personal data and as such are protected under the Dutch Data Protection Act Would the information included in that concept, or the extent of the privacy rights, depend upon the celebrity of the person, or upon other elements? Please describe briefly. From a data protection perspective, the fact that a data subject is a celebrity does not make a difference. All data subjects have equal rights. It can however make a difference when the right to freedom of speech clashes with the right to protection of private and family life (addressed in more detail below). Both are fundamental rights and have to be balanced on a case by case basis, taking into account all circumstances of the case. The fact that someone is a celebrity is one of those circumstances Would privacy rights also apply in relation to legal persons (vs. physical persons)? Privacy rights in principle apply to individuals only. A legal entity cannot derive protection from the data protection legislation. However, a legal entity can try and prevent or stop the divulgation of information on the legal entity by arguing that such divulgation constitutes a tortuous act against the legal entity (e.g. when the information is clearly incorrect and harmful to the entity or is otherwise libellous) Would privacy rights encompass private information made available only to some chosen persons (authorized recipients). So, for instance, can disclosure to third parties, by one of the authorized recipients of the private information, be part of the privacy rights (e.g. disclosure of private correspondence, private phone calls, information shared on social media, etc.) Yes, the same rules as above would apply.

4 1.3. Is there a specific status for fictional use of information related to an individual? And are disclaimers sufficient to allow such use? If an individual can be identified through the fictional use of information, the data protection rules apply. 2. Freedom of speech 2.1. Is there a on the one hand a statutory/ treaty based freedom or constitutional recognition of Freedom of speech or on the other hand is that freedom based on case-law. Freedom of speech/expression under Dutch law has its basis in the Constitution (article 7) as well as in various treaties, including the Charter of Fundamental Rights of the European Union (article 11) and European Convention on Human Rights (article 10). There is ample Dutch and EU case law on these rights and Dutch courts generally give these rights a broad scope If it is a statutory/treaty/ constitution based freedom is it based on domestic or supranational law? See Describe the main characteristics of the freedom of speech as recognized in your jurisdiction: beneficiaries; Everyone in the Netherlands has the same rights to freedom of speech extent of the freedom of speech; The extent is broad and is only limited by the responsibilities and obligations provided for by law (e.g. discrimination). Dutch courts are reluctant in limiting the freedom of speech. When someone requests that a certain publication is prohibited (and thus the freedom of speech is limited), the courts will (have to) balance the right of freedom of speech against the legitimate interests of the claimant. The test is generally whether the publication would constitute a wrongful act against the claimant. Unfounded allegations or libellous comments can be prohibited in this way exceptions;

5 See above. The freedom of speech can be limited where it constitutes a wrongful act. Furthermore, the Dutch Constitution provides the possibility to limit or prohibit access to certain publication for people under the age of 16 to protect public morality. Furthermore, advertorials for certain products are prohibited (tobacco) or limited to certain time slots, e.g. alcohol (no advertisements between 6 am and 9 pm specific status for press (including online press)? There are no specific freedom of speech rules for the press (including online press), other than that courts would be even more reluctant to prohibit press publications as these are in principle deemed to be in the public interest. Again, the test would be whether or not the publication constitutes a wrongful act. From a data protection perspective, certain rules and prohibitions do not apply to journalists and accordingly the have broader possibilities to process personal data for journalistic purposes. 3. Hierarchy between Freedom of Speech on one side and privacy rights on the other side Under the law applicable in your jurisdiction, is there a clear hierarchy between freedom of speech on the one hand and privacy rights on the other? It has been addressed above: there is no clear hierarchy. Both are considered fundamental or human rights. When the right to freedom of expression clashes with the right to privacy/protection of family and private life, it has to be determined on the basis of all circumstances of the case which right prevails in that specific case. The test is whether the (intended) publication constitutes a wrongful act against the person invoking his/her privacy rights. If so, the publication may be prohibited and the privacy right prevail. If not, the publication will be allowed and the right to freedom of speech prevails What would be the most significant criteria allowing freedom of speech or privacy rights to prevail over the other (e.g. public interest argument)? Relevant criteria would be public interest (in particular for journalists), but also whether the (intended) publication/allegations are based on verifiable facts or whether it is (clearly) unfounded and only intended to

6 bring harm. The fact that it regards a celebrity or a minor can also be relevant. 4. Remedies available in your jurisdiction to protect individuals against disclosure of information belonging to their privacy 4.1. Are there pre-emptive remedies to avoid disclosure of such information before disclosure occurs? Describe briefly the main remedies available. In terms of proceedings, there are two options: summary proceedings or proceedings on the merits. Summary proceedings are brief and fast and in principle only preliminary relief can be claimed in summary proceedings. It is often used in cases where a party wishes to prevent certain publication and time is of the essence. Proceedings on the merits are more time consuming and a judgment in such proceedings can be of a declaratory nature. In such proceedings, a claiming party can ask for a court order to prohibit disclosure of the information. A claim for damages is also an option, but it is not likely to be awarded in summary proceedings given the injunctive character. Further, the court can order a penalty to be paid by the defendant in the event it ignores the court order by disclosing the information. The court will weigh the privacy right of the person involved against the right to freedom of speech Are gagging orders 1 or super injunctions 2 as known in the UK known under the legal system of your country? Describe briefly their main characteristics. Gagging orders or super injunctions as such are unknown in the Dutch legal system. However, in certain cases court proceedings may take place behind closed doors instead of in public. Further, the court may prohibit a party to disclose specific information, which can also be seen as a gagging order Are there other post-disclosure remedies, such as for example damage claims, rectification claims, right of answer. Describe shortly. Rectification: In the event of a wrongful publication, a party can claim rectification. A court will only order the disclosing party to rectify in the event the court has judged that the publication was unlawful. The court will decide on the content of the 1 See for details : 2 See for details:

7 rectification, as well as the location, frequency and/or term. Damages: A court may order that the disclosing parties must pay damages to the individuals harmed by a wrongful publication. The various circumstances will be weighed when it comes to a damages claim; the freedom of expression against the right to privacy. Prohibition to repeated disclose: The court may prohibit a party to repeat the publication of information that is deemed to be wrongful. Complaint at the Netherlands press council: An alternative remedy is filing a complaint at the Netherlands press council (Raad voor de Journalistiek) based on violations of good journalistic practice. The council only handles complaints on professional journalists or on people/entities who, on a regular basis and for remuneration, collaborate on the editorial content of a mass medium. The opinions of the council can be published, in certain cases anonymized. The council cannot impose a sentence on the journalist or order the journalist to pay monetary compensation In the case of damages, how are they calculated? Material damages are calculated on the basis of actual damages suffered and must be proven by the claiming party. Immaterial damages will be determined ex aequo et bono. There is no standard In case of disclosure of private information, who can be held liable for damages, especially online? In principle, the private person or entity who has disclosed the private information. E.g. the newspaper or the broadcasting company for a television program, or the journalist for a blog on his website. In the event of online disclosure, the hosting provider might also be liable for any damages. Depending on the circumstances, an access provider or hosting provider can be held liable for damages if its storage or network was used for the wrongful disclosure. Articles of the E-commerce Directive 2000/31/EG, implemented in the Dutch Civil Code in article 6:196c, set out that an information service providers, acting as

8 intermediary, can act unlawful. For instance if a hosting providers is aware that the disclosed content is wrongful, but it has not acted upon a notice and take down procedure Are there special defences to a cause of action for information disclosed by the press/ media? As part of your answer please explain what is range of news information organizations is covered by the definitions press/ media? As set out in our answer to question 3, the public interest and freedom of speech may prevail over the right of privacy of an individual. The profession of journalist is not protected and therefore anyone publishing on- or offline can claim freedom of speech based on article 10 European Convention on Human Rights (ECHR). Please note that the circumstances pointed out in and 3.2 are also relevant here Is there a specific protection offered to informants/sources? A journalist s source or informant can be protected based on article 8 and 10 of the ECHR. In a pending case for the Dutch supreme court, the attorney general has argumented that the protection for a journalist should in certain cases also apply to its sources. 3 The attorney general refers to various cases from the European Court of Human Rights, amongst others this part of the Telegraaf/The Netherlands 4 case: Protection of journalistic sources is one of the basic conditions for press freedom( ). Without such protection, sources may be deterred from assisting the press in informing the public on matters of public interest. As a result the vital public-watchdog role of the press may be undermined and the ability of the press to provide accurate and reliable information may be adversely affected. Having regard to the importance of the protection of journalistic sources for press freedom in a democratic society and the potentially chilling effect an order of source disclosure has on the exercise of that freedom, such a measure cannot be compatible with Article 10 of the Convention unless it is justified by an overriding requirement in the public interest. The Attorney General concludes that the protection of Article 10 ECHR does not necessarily only apply to journalists, but also to its sources Are the principles described in your answers above also applicable to the online world? Is there any specific case-law in your country relating to social media, and if so please summarize this? 3 Conclusion of Attorney General, 16 September 2014, case number 13/ European Court of Human Rights, 22 February 2013, 39315/06

9 Yes, the principles described above also apply to online disclosure, including social media. Please note that in social media, the terms and conditions from the social media provider will apply to its users. This means that its users are also bound by the contractual obligations regarding, inter alia, disclosure of certain personal information and use and abuse of the platform Are there specific remedies against disclosure of information that (could) damage an individual reputation (such as slander or libel)? Describe these remedies briefly. Slander and libel are criminal offences under article 261 and 262 of the Dutch Criminal Code. If the criminal court has ruled that certain publications are slander or libel, the wrongful character of the publication is to be assumed. In civil proceedings, this can be the ground for claim for damages and/or a prohibition to (repeatedly) publish (please see 4.1 and 4.3 on remedies). In the criminal proceedings, the victim can also make a claim for damages. Apart from the criminal proceedings, the civil court may also assess the wrongful character of slander, libel or defamation. The remedies are as set out above and in 4.1 and Forum and applicable law Describe shortly what rules are exist in your jurisdiction for the determination of the forum and the applicable law. The Brussels I Regulation on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters (1215/2012) and the Rome II regulation on the law applicable to non-contractual obligations (864/2007) are in force in the Netherlands. In cases with an international component (such as a defendant established in a another country), determination of forum and applicable law for civil and non-contractual matters in the Netherlands will first take place based on these regulations. If the forum and/or applicable law cannot be determined based on the regulations, an international convention or treaty might apply (e.g. when a citizen from a non-member state is involved). If this is not the case, the Dutch national rules on international private law apply, set out in Book 1, section 1 of the Dutch Code of Civil Procedure (Wetboek van Burgerlijke Rechtsvordering). Based on such national rules, in principle the case must have some connection to the Netherlands (e.g. damages have occurred in the Netherlands).

10 Forum: If the ground for the claim is a wrongful act, the courts of the Netherlands are competent if for example: The disclosing person or entity is living in or established in the Netherlands; The place where the harmful event occurred or may occur is the Netherlands (article 7 sub 2 Brussels I). Applicable law: Based on article 4 Rome II, the applicable law in tort cases will be the law of the country where the damage occurs, irrespective of the country in which the event giving rise to the damage occurred and irrespective of the country or countries in which the indirect consequences of that event occur. Given the focus on privacy protection in this questionnaire, please note that the applicability of the Dutch Data Protection Act is determined based on article 4 of the act. The first paragraph of article 4 sets out that the act applies to the processing of personal data carried out in the context of the activities of an establishment of a data controller in the Netherlands. Based on the second paragraph, the act can also apply to the processing of personal data if a data controller does not have an establishment in the Netherlands, but it makes us of (automated) equipment situated in the Netherlands Are there specific rules for breaches caused online (when the information is accessible from different jurisdictions)? There are no specific rules for online caused breaches. The circumstances of the case will be taken into account in order to assess where the damages occur in case of a wrongful publication, such as: where is the information hosted, in which language(s) is the website written etc From your experience, what reforms should be made to the legal system of your country to better protect individual privacy, if any? The new privacy regulation in Europe is just around the corner. Apart from new legislation, the parties controlling and processing personal data should also be aware of its responsibilities and the vulnerability of the individual. Informed consent is key; which permission does an individual grant to its providers by signing up for a new service? Transparency is very important in this perspective.

11 5. Interplay between data protection rules and privacy rights 5.1. Summarize how does data protection law in your jurisdiction protects privacy or other personal data being used in online media? The processing of personal data, this includes use in online media, should comply with the Dutch Data Protection Act. Processing of data is only allowed on the grounds set out in article 8 of the Dutch Data Protection Act. 5 The data controller must inform the individuals whose data it is collecting and should in principle register the data processing at the CBP. With regard to people s images, the so-called portrait right may apply. This portrait right is embodied in the Dutch Copyright Act, but does in fact relate more to privacy protection. On the basis of this portrait right, a person whose image is photographed, filmed or recorded in another way, may oppose the publication of this image in case it has a reasonable interest in opposing this publication Is there an effective a right of opposition to collection of data? Under article 35 6 of the Dutch Data Protection Act, an individual can ask a data controller to provide an overview of the personal data of the individual collected by the data controller. Based on article 36 7 of the Dutch Data Protection Act, the individual can request the rectification, erasure or blocking of its personal data. Further, the individual has the right to object to certain processing of its personal data under article 40 8 and 41 9 of the Dutch Data Protection Act. If the data controller does not respond to the aforementioned requests, the individual can start court proceedings. 6. Right to be forgotten 6.1. Is there a statutory or case-law based right to be forgotten in your jurisdiction (whether under domestic or supranational law)? Describe it briefly. The right to be forgotten is a statutory right set out in clause 36 of the 5 Implementation of article 7 of the Data Protection Directive (95/46/EC) 6 Implementation of article 12 sub a of the Data Protection Directive (95/46/EC) 7 Implementation of article 12 sub b of the Data Protection Directive (95/46/EC) 8 Implementation of article 14 sub a of the Data Protection Directive (95/46/EC) 9 Implementation of article 14 sub b of the Data Protection Directive (95/46/EC)

12 Dutch Data Protection Act (please also see question 5.2) Is there relevant case law in your jurisdiction regarding the right to be forgotten and/or are there other guidelines (whether under domestic or supranational legal procedure) for a successful claim under the right to be forgotten. There is case law on this subject, most cases are about requests from individuals to have their personal data removed or corrected by a data controller. Some of these cases are about the incident registers kept by financial institutions such as banks and insurance companies. Such incident registers must be registered at the CBP. The financial sector has published a protocol with guidelines for the use of incident registers Did the view on the right to be forgotten change in your jurisdiction due to the European Court of Justice Case in Google Spain v. AEPD and González (C-131/12)? Is there any case law arising from this decision in your jurisdiction? Since the ECJ ruling in the Google Spain case there has been some case law in which the claimant referred in its claim to the Google Spain case. There have been two recent cases 10 for the District Court in Amsterdam, in which the court did not order Google to remove certain search results. The first case dealt with a request from a convicted criminal to have certain search results removed. The court refused: The conviction for a serious crime such as the one at issue and the negative publicity as a consequence thereof, in general provide information about an individual that will remain relevant. The negative qualifications that may be involved will only be excessive or unnecessarily defamatory in very exceptional cases, for instance when the offense committed is brought up again without a clear reason, apparently for no other purpose than to damage the individual involved, if reporting is not factual but rather a slanging-match. The court ruled that the request from this claimant was not a very exceptional case. Relevant in the most recent case is that the judge prevails the freedom of speech over the nuisance of the claimant who is still confronted by a, 10 District Court of Amsterdam, 18 September 2014, and District Court of Amsterdam, 12 February 2015,

13 for him, unpleasant story about the renovation of his luxury home and unpaid contractor bills. The fact that the claimant does not like it that he is still confronted by his acquaintances or business contacts with the container story is very understandable. However, this does not outweigh the right of freedom of information of Google Inc. The judge also emphasized that the search results were still relevant. 7. Are there other aspects to take into consideration in your jurisdiction in relation to freedom of speech, the privacy right and the right to be forgotten? It might be worth mentioning that in the Netherlands, the freedom of speech is not often limited.